Skip to content

How to forward Kubernetes events with the rancher-logging chart

This document (000021115) is provided subject to the disclaimer at the end of this document.

Environment

Situation

This article details how to configure Kubernetes event forwarding with rancher-logging.

Resolution

Rancher logging supports forwarding Kubernetes events, via the logging-operator Event Tailer extension. The steps below detail how to enable the Event Tailer extension, and forward the events.

  1. Create the EvenTailer resource: The EventTailer resource creates a Pod that listens for Kubernetes events and writes them to stdout, enabling their collection and forwarding by the logging-operator's fluentbit and fluentd processes.
apiVersion: logging-extensions.banzaicloud.io/v1alpha1
kind: EventTailer
metadata:
     name: cluster
spec:
     controlNamespace: cattle-logging-system
  1. Create a Flow resource: A Flow is a namespaced resource that uses filters and selectors to route log messages to the appropriate output. In this instance the Kubernetes event logs generated by the cluster EventTailer above will be routed to the cluster-event-output.
apiVersion: logging.banzaicloud.io/v1beta1
kind: Flow
metadata:
     name: eventtailer-flow
     namespace: cattle-logging-system
spec:
     filters:
  - tag_normaliser: {}
localOutputRefs:
  - cluster-event-output
match:
  - select:
      labels:
        app.kubernetes.io/instance: cluster-event-tailer
  1. Create an Output resource: An Output is a namespaced resource that defines where the log messages are sent. In this instance, the logs are sent to an Elasticsearch instance. Configure the Output to match your logging endpoint, per the Rancher Logging documentation.
apiVersion: logging.banzaicloud.io/v1beta1
kind: Output
metadata:
  name: cluster-event-output
  namespace: cattle-logging-system
spec:
  elasticsearch:
    host:"IP or elastic hostname"
    port: 9200
    scheme: http

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.